This vulnerability arises from improper neutralization of special elements used in an SQL command (CWE-89) in Koha versions 25.05.0, 25.11.0, and 26.05.0. Authenticated staff with the acquisition => order_receive permission can manipulate the orderby request parameter, which is passed to the C4::Acquisition::GetInvoices function. Although the column name is allow-listed, the direction token is concatenated directly into the SQL ORDER BY clause without validation, leading to a blind time-based SQL injection. This flaw allows attackers to extract sensitive database contents including patron PII, staff password hashes, and two-factor secrets.

The vulnerability allows an authenticated staff member with specific permissions to perform blind SQL injection attacks, enabling unauthorized reading of arbitrary database contents. This includes exposure of sensitive information such as patron personally identifiable information, staff bcrypt password hashes, and two-factor authentication secrets. The impact is confidentiality loss with potential for further compromise due to leaked credentials and authentication secrets. Availability impact is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict acquisition => order_receive permissions to trusted staff only and monitor for unusual activity related to the orderby parameter in acqui/parcels.pl. Avoid exposing this functionality to untrusted users. Follow vendor advisories for updates on patches or official mitigations.